Improper Handling of Insufficient Permissions or Privileges in wagtail - #VU156667
Published: October 21, 2026
Vulnerability identifier: #VU156667
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-280
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access page contents that would otherwise be unavailable to them.
The vulnerability exists due to improper handling of insufficient permissions in Wagtail's internal Pages admin API when processing requests for ancestor pages. A remote user can request the contents of a direct parent of a page they can edit, or a common ancestor of multiple pages they can edit, to disclose otherwise restricted page contents.
Affected software
wagtail
Remediation
Install security update from vendor's website.
wagtail - addressed in versions 7.0.10, 7.4.4, 8.0.1